Skip to content
Threat Feed
Subscribe

Product

AWS CLI

1 brief RSS
low advisory

AWS Discovery API Calls via CLI from a Single Resource

A single AWS resource is making multiple read-only discovery API calls via the AWS CLI within a 10-second window, indicating potential reconnaissance attempts using compromised credentials or a compromised instance.

AWS +5 cloudtrail discovery aws-cli threat-detection
2r 3t